devise 1.3.4 → 1.4.1

data/test/integration/recoverable_test.rb

@@ -17,7 +17,7 @@ class PasswordTest < ActionController::IntegrationTest
     click_button 'Send me reset password instructions'
   end
 
-  def reset_password(options={}, &block)    
+  def reset_password(options={}, &block)
     visit edit_user_password_path(:reset_password_token => options[:reset_password_token]) unless options[:visit] == false
     assert_response :success
 
@@ -29,11 +29,11 @@ class PasswordTest < ActionController::IntegrationTest
 
   test 'reset password with email of different case should succeed when email is in the list of case insensitive keys' do
     create_user(:email => 'Foo@Bar.com')
-    
+
     request_forgot_password do
       fill_in 'email', :with => 'foo@bar.com'
     end
-    
+
     assert_current_url '/users/sign_in'
     assert_contain 'You will receive an email with instructions about how to reset your password in a few minutes.'
   end
@@ -41,11 +41,11 @@ class PasswordTest < ActionController::IntegrationTest
   test 'reset password with email of different case should fail when email is NOT the list of case insensitive keys' do
     swap Devise, :case_insensitive_keys => [] do
       create_user(:email => 'Foo@Bar.com')
-      
+
       request_forgot_password do
         fill_in 'email', :with => 'foo@bar.com'
       end
-      
+
       assert_response :success
       assert_current_url '/users/password'
       assert_have_selector "input[type=email][value='foo@bar.com']"
@@ -53,6 +53,32 @@ class PasswordTest < ActionController::IntegrationTest
     end
   end
 
+  test 'reset password with email with extra whitespace should succeed when email is in the list of strip whitespace keys' do
+    create_user(:email => 'foo@bar.com')
+
+    request_forgot_password do
+      fill_in 'email', :with => ' foo@bar.com '
+    end
+
+    assert_current_url '/users/sign_in'
+    assert_contain 'You will receive an email with instructions about how to reset your password in a few minutes.'
+  end
+
+  test 'reset password with email with extra whitespace should fail when email is NOT the list of strip whitespace keys' do
+    swap Devise, :strip_whitespace_keys => [] do
+      create_user(:email => 'foo@bar.com')
+
+      request_forgot_password do
+        fill_in 'email', :with => ' foo@bar.com '
+      end
+
+      assert_response :success
+      assert_current_url '/users/password'
+      assert_have_selector "input[type=email][value=' foo@bar.com ']"
+      assert_contain 'not found'
+    end
+  end
+
   test 'authenticated user should not be able to visit forgot password page' do
     sign_in_as_user
     assert warden.authenticated?(:user)
@@ -161,7 +187,7 @@ class PasswordTest < ActionController::IntegrationTest
     create_user
     post user_password_path(:format => 'xml'), :user => {:email => "user@test.com"}
     assert_response :success
-    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
+    assert_equal response.body, { }.to_xml
   end
 
   test 'reset password request with invalid E-Mail in XML format should return valid response' do
@@ -194,4 +220,38 @@ class PasswordTest < ActionController::IntegrationTest
     assert_response :unprocessable_entity
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
   end
+
+  test "when using json requests to ask a confirmable request, should not return the object" do
+    user = create_user(:confirm => false)
+
+    post user_password_path(:format => :json), :user => { :email => user.email }
+
+    assert_response :success
+    assert_equal response.body, "{}"
+  end
+
+  test "when in paranoid mode and with an invalid e-mail, asking to reset a password should display a message that does not indicates that the e-mail does not exists in the database" do
+    swap Devise, :paranoid => true do
+      visit_new_password_path
+      fill_in "email", :with => "arandomemail@test.com"
+      click_button 'Send me reset password instructions'
+
+      assert_not_contain "1 error prohibited this user from being saved:"
+      assert_not_contain "Email not found"
+      assert_contain "If your e-mail exists on our database, you will receive a password recovery link on your e-mail"
+      assert_current_url "/users/password"
+    end
+  end
+
+  test "when in paranoid mode and with a valid e-mail, asking to reset password should display a message that does not indicates that the email exists in the database and redirect to the failure route" do
+    swap Devise, :paranoid => true do
+      user = create_user
+      visit_new_password_path
+      fill_in 'email', :with => user.email
+      click_button 'Send me reset password instructions'
+
+      assert_contain "If your e-mail exists on our database, you will receive a password recovery link on your e-mail"
+      assert_current_url "/users/password"
+    end
+  end
 end

data/test/integration/registerable_test.rb

@@ -211,7 +211,7 @@ class RegistrationTest < ActionController::IntegrationTest
     get new_user_registration_path(:format => 'xml')
     assert_response :success
     assert_match %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>), response.body
-    assert_no_match(/<confirmation_token>/, response.body) if DEVISE_ORM == :active_record
+    assert_no_match(/<confirmation-token/, response.body) if DEVISE_ORM == :active_record
   end
 
   test 'a user with JSON sign up stub' do

data/test/integration/rememberable_test.rb

@@ -38,6 +38,18 @@ class RememberMeTest < ActionController::IntegrationTest
     assert_nil request.cookies["remember_user_cookie"]
   end
 
+  test 'handles unverified requests gets rid of caches' do
+    swap UsersController, :allow_forgery_protection => true do
+      post exhibit_user_url(1)
+      assert_not warden.authenticated?(:user)
+
+      create_user_and_remember
+      post exhibit_user_url(1)
+      assert_equal "User is not authenticated", response.body
+      assert_not warden.authenticated?(:user)
+    end
+  end
+
   test 'generate remember token after sign in' do
     user = sign_in_as_user :remember_me => true
     assert request.cookies["remember_user_token"]
@@ -69,7 +81,14 @@ class RememberMeTest < ActionController::IntegrationTest
     assert_response :success
     assert warden.authenticated?(:user)
     assert warden.user(:user) == user
-    assert_match /remember_user_token[^\n]*HttpOnly\n/, response.headers["Set-Cookie"], "Expected Set-Cookie header in response to set HttpOnly flag on remember_user_token cookie."
+    assert_match /remember_user_token[^\n]*HttpOnly/, response.headers["Set-Cookie"], "Expected Set-Cookie header in response to set HttpOnly flag on remember_user_token cookie."
+  end
+
+  test 'remember the user before sign up and redirect him to his home' do
+    user = create_user_and_remember
+    get new_user_registration_path
+    assert warden.authenticated?(:user)
+    assert_redirected_to root_path
   end
 
   test 'cookies are destroyed on unverified requests' do

data/test/integration/trackable_test.rb

@@ -61,4 +61,21 @@ class TrackableHooksTest < ActionController::IntegrationTest
       assert_nil user.last_sign_in_at
     end
   end
+  
+  test "do not track if devise.skip_trackable is set" do
+    user = create_user
+    sign_in_as_user do
+      header 'devise.skip_trackable', '1'
+    end
+    user.reload
+    assert_equal 0, user.sign_in_count
+    visit destroy_user_session_path
+    
+    sign_in_as_user do
+      header 'devise.skip_trackable', false
+    end
+    user.reload
+    assert_equal 1, user.sign_in_count
+  end
+
 end

data/test/mapping_test.rb

@@ -50,6 +50,11 @@ class MappingTest < ActiveSupport::TestCase
     assert_equal [:rememberable, :database_authenticatable], Devise.mappings[:admin].strategies
   end
 
+  test 'has no input strategies depending on the model declaration' do
+    assert_equal [:rememberable, :token_authenticatable], Devise.mappings[:user].no_input_strategies
+    assert_equal [:rememberable], Devise.mappings[:admin].no_input_strategies
+  end
+
   test 'find scope for a given object' do
     assert_equal :user, Devise::Mapping.find_scope!(User)
     assert_equal :user, Devise::Mapping.find_scope!(:user)

data/test/models/database_authenticatable_test.rb

@@ -11,6 +11,39 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
     user.save!
     assert_equal email.downcase, user.email
   end
+  
+  test 'should remove whitespace from strip whitespace keys when saving' do
+    # strip_whitespace_keys is set to :email by default.
+    email = ' foo@bar.com '
+    user = new_user(:email => email)
+
+    assert_equal email, user.email
+    user.save!
+    assert_equal email.strip, user.email
+  end
+
+  test 'find_for_authentication and filter_auth_params should not modify the conditions hash' do
+    FilterAuthUser = Class.new(User) do
+      def self.filter_auth_params(conditions)
+        if conditions.is_a?(Hash) && login = conditions.delete('login')
+          key = login.include?('@') ? :email : :username
+          conditions[key] = login
+        end
+        super(conditions)
+      end
+    end
+
+    conditions = { 'login' => 'foo@bar.com' }
+    FilterAuthUser.find_for_authentication(conditions)
+
+    assert_equal({ 'login' => 'foo@bar.com' }, conditions)
+  end
+  
+  test "filter_auth_params should not convert booleans and integer to strings" do
+    conditions = { 'login' => 'foo@bar.com', "bool1" => true, "bool2" => false, "fixnum" => 123, "will_be_converted" => (1..10) }
+    conditions = User.__send__(:filter_auth_params, conditions)
+    assert_equal( { 'login' => 'foo@bar.com', "bool1" => true, "bool2" => false, "fixnum" => 123, "will_be_converted" => "1..10" }, conditions)
+  end
 
   test 'should respond to password and password confirmation' do
     user = new_user
@@ -70,7 +103,7 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
       :password => 'pass321', :password_confirmation => 'pass321')
     assert user.reload.valid_password?('pass321')
   end
-
+  
   test 'should add an error to current password when it is invalid' do
     user = create_user
     assert_not user.update_with_password(:current_password => 'other',
@@ -87,6 +120,15 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
     assert_match "can't be blank", user.errors[:current_password].join
   end
 
+  test 'should run validations even when current password is invalid or blank' do
+    user = UserWithValidation.create!(valid_attributes)
+    user.save
+    assert user.persisted?
+    assert_not user.update_with_password(:username => "")
+    assert_match "usertest", user.reload.username
+    assert_match "can't be blank", user.errors[:username].join
+  end
+
   test 'should ignore password and its confirmation if they are blank' do
     user = create_user
     assert user.update_with_password(:current_password => '123456', :email => "new@example.com")
@@ -108,6 +150,19 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
     assert user.password_confirmation.blank?
   end
 
+  test 'should update the user without password' do
+    user = create_user
+    user.update_without_password(:email => 'new@example.com')
+    assert_equal 'new@example.com', user.email
+  end
+
+  test 'should not update password without password' do
+    user = create_user
+    user.update_without_password(:password => 'pass321', :password_confirmation => 'pass321')
+    assert !user.reload.valid_password?('pass321')
+    assert user.valid_password?('123456')
+  end
+
   test 'downcase_keys with validation' do
     user = User.create(:email => "HEllO@example.com", :password => "123456")
     user = User.create(:email => "HEllO@example.com", :password => "123456")

data/test/models/encryptable_test.rb

@@ -31,7 +31,7 @@ class EncryptableTest < ActiveSupport::TestCase
 
   test 'should generate a base64 hash using SecureRandom for password salt' do
     swap_with_encryptor Admin, :sha1 do
-      ActiveSupport::SecureRandom.expects(:base64).with(15).returns('friendly_token')
+      SecureRandom.expects(:base64).with(15).returns('friendly_token')
       assert_equal 'friendly_token', create_admin.password_salt
     end
   end

data/test/models/recoverable_test.rb

@@ -198,8 +198,13 @@ class RecoverableTest < ActiveSupport::TestCase
 
   test 'should save the model when the reset_password_sent_at doesnt exist' do
     user = create_user
-    user.stubs(:respond_to?).with(:reset_password_sent_at=).returns(false)
-    user.stubs(:respond_to?).with(:headers_for).returns(false)
+    def user.respond_to?(meth, *)
+      if meth == :reset_password_sent_at=
+        false
+      else
+        super
+      end
+    end
     user.send_reset_password_instructions
     user.reload
     assert_not_nil user.reset_password_token
@@ -207,7 +212,13 @@ class RecoverableTest < ActiveSupport::TestCase
 
   test 'should have valid period if does not respond to reset_password_sent_at' do
     user = create_user
-    user.stubs(:respond_to?).with(:reset_password_sent_at).returns(false)
+    def user.respond_to?(meth, *)
+      if meth == :reset_password_sent_at
+        false
+      else
+        super
+      end
+    end
     assert user.reset_password_period_valid?
   end
 

data/test/models/rememberable_test.rb

@@ -15,6 +15,14 @@ module SharedRememberableTest
     resource.forget_me!
     assert resource.remember_created_at.nil?
   end
+  
+  test 'forget_me should not try to update resource if it has been destroyed' do
+    resource = create_resource
+    resource.destroy
+    resource.expects(:remember_created_at).never
+    resource.expects(:save).never
+    resource.forget_me!
+  end
 
   test 'remember is expired if not created at timestamp is set' do
     assert create_resource.remember_expired?

data/test/models/token_authenticatable_test.rb

@@ -27,12 +27,6 @@ class TokenAuthenticatableTest < ActiveSupport::TestCase
   end
 
   test 'should return nil when authenticating an invalid user by authentication token' do
-    if DEVISE_ORM == :mongoid
-      raise 'There is an incompatibility between Devise and Mongoid'  <<
-            ' that makes this test break. For more information, check' <<
-            ' this issue: https://github.com/mongoid/mongoid/issues/725'
-    end
-
     user = create_user
     user.ensure_authentication_token!
     user.confirm!

data/test/models/validatable_test.rb

@@ -8,7 +8,7 @@ class ValidatableTest < ActiveSupport::TestCase
     assert_equal 'can\'t be blank', user.errors[:email].join
   end
 
-  test 'should require uniqueness of email, allowing blank' do
+  test 'should require uniqueness of email if email has changed, allowing blank' do
     existing_user = create_user
 
     user = new_user(:email => '')
@@ -18,18 +18,24 @@ class ValidatableTest < ActiveSupport::TestCase
     user.email = existing_user.email
     assert user.invalid?
     assert_match(/taken/, user.errors[:email].join)
+
+    user.save(:validate => false)
+    assert user.valid?
   end
 
-  test 'should require correct email format, allowing blank' do
+  test 'should require correct email format if email has changed, allowing blank' do
     user = new_user(:email => '')
     assert user.invalid?
     assert_not_equal 'is invalid', user.errors[:email].join
 
-    %w(invalid_email_format email@invalid invalid$character@mail.com other@not 123).each do |email|
+    %w(invalid_email_format 123 $$$ \(\) ).each do |email|
       user.email = email
       assert user.invalid?, 'should be invalid with email ' << email
       assert_equal 'is invalid', user.errors[:email].join
     end
+
+    user.save(:validate => false)
+    assert user.valid?
   end
 
   test 'should accept valid emails' do
@@ -85,12 +91,19 @@ class ValidatableTest < ActiveSupport::TestCase
     user = create_user.reload
     user.password = user.password_confirmation = nil
     assert user.valid?
-  
+
     user.password_confirmation = 'confirmation'
     assert user.invalid?
     assert_not (user.errors[:password].join =~ /is too long/)
   end
 
+  test 'should complain about length even if possword is not required' do
+    user = new_user(:password => 'x'*129, :password_confirmation => 'x'*129)
+    user.stubs(:password_required?).returns(false)
+    assert user.invalid?
+    assert_equal 'is too long (maximum is 128 characters)', user.errors[:password].join
+  end
+
   test 'shuold not be included in objects with invalid API' do
     assert_raise RuntimeError do
       Class.new.send :include, Devise::Models::Validatable

data/test/models_test.rb

@@ -10,6 +10,10 @@ class WithValidation < Admin
   devise :database_authenticatable, :validatable, :password_length => 2..6
 end
 
+class UserWithValidation < User
+  validates_presence_of :username
+end
+
 class Several < Admin
   devise :validatable
   devise :lockable

data/test/omniauth/url_helpers_test.rb

@@ -35,6 +35,10 @@ class OmniAuthRoutesTest < ActionController::TestCase
     end
   end
 
+  test 'should generate authorization path for named open_id omniauth' do
+    assert_match "/users/auth/google", @controller.omniauth_authorize_path(:user, :google)
+  end
+
   test 'should generate authorization path with params' do
     assert_match "/users/auth/open_id?openid_url=http%3A%2F%2Fyahoo.com",
                   @controller.omniauth_authorize_path(:user, :open_id, :openid_url => "http://yahoo.com")

data/test/rails_app/app/controllers/home_controller.rb

@@ -5,6 +5,15 @@ class HomeController < ApplicationController
   def private
   end
 
+  def user_dashboard
+  end
+
+  def admin_dashboard
+  end
+
+  def join
+  end
+
   def set
     session["devise.foo_bar"] = "something"
     head :ok